ASPSiteware Project Reporter SQL injection Vulnerability

vendor:

Project Reporter

by:

R4dc0re

7,5

CVSS

HIGH

SQL Injection

CWE

Product Name: Project Reporter

Affected Version From: 1.0

Affected Version To: 1.0

Patch Exists: NO

Related CWE: N/A

CPE: a:aspsiteware:project_reporter:1.0

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2010

ASPSiteware Project Reporter SQL injection Vulnerability

Project Reporter is an application for any organization that needs to share information on projects in real time. By manipulating the 'iType' parameter in the 'type.asp' page, an attacker can inject malicious SQL code into the backend Access database.

Mitigation:

Input validation should be used to prevent SQL injection attacks. All user-supplied input should be validated and filtered before being used in an SQL query.

Source

Exploit-DB raw data:

# Author: R4dc0re
# Exploit Title: ASPSiteware Project Reporter SQL injection Vulnerability
# Date: 04-12-2010
# Vendor or Software Link: www.aspsiteware.com
# Category:WebApp
#Version:1.0
#Price:50$
#Contact: R4dc0re@yahoo.fr
#Website: www.1337db.com
#Greetings to: R0073r(1337db.com), L0rd CrusAd3r,Sid3^effects and to rest of the 1337db members 

Submit Your Exploit at Submit@1337db.com

########################################################################################
[Product Detail]

Project Reporter is an application for any organization that needs to share information on projects in real time.
Project Teams can review project information and submit update reports on projects they are involved with.
Backend by Access database, Project Reporter can store thousands of reports by project.
Works great with a member management system that allows you to manage registered members of your web site 
allowing members to see reports only on the projects they are assigned.
 
[Vulnerability]

SQL Injection:

http://server/Project/type.asp?iType=[Code]
########################################################################################